diff --git a/README.md b/README.md index 462aeac..e01d78d 100644 --- a/README.md +++ b/README.md @@ -264,6 +264,23 @@ Just change: - S3 bucket is private by default - CloudFront serves as the only public entry point - IAM follows least privilege principle +- In in _main.tf_ file inside _terraform/bootstrap_, + +``` +lifecycle { + prevent_destroy = false + } +``` + +is set to _false_ for easy clean-up. In real production environments, I would set _prevent_destroy_ as _true_. This protects the remote state bucket from accidental data loss. + +In addition, + +``` +force_destroy = true +``` + +should be deleted or set as _false_ in real production environments. --- @@ -406,6 +423,7 @@ Writing reusable setup instructions and architecture explanations can improve: - Add custom domain + Route53 automation - ACM SSL certificate provisioning +- Integrate terraform into CI/CD pipeline - Automated performance testing in CI --- diff --git a/terraform/bootstrap/main.tf b/terraform/bootstrap/main.tf index 429a7c4..9f4d48d 100644 --- a/terraform/bootstrap/main.tf +++ b/terraform/bootstrap/main.tf @@ -35,9 +35,11 @@ resource "aws_s3_bucket" "terraform_state" { bucket = "${var.project_name}-${var.backend_bucket_name}-${random_id.suffix.hex}" lifecycle { - prevent_destroy = true + prevent_destroy = false } + force_destroy = true + tags = { Name = "${var.project_name}-terraform-backend" Environment = "Shared" diff --git a/terraform/bootstrap/variables.tf b/terraform/bootstrap/variables.tf index afc7c0f..723768e 100644 --- a/terraform/bootstrap/variables.tf +++ b/terraform/bootstrap/variables.tf @@ -16,4 +16,4 @@ variable "project_name" { variable "s3_encryption_algorithm" { description = "Encryption algorithm for S3 buckets" type = string -} \ No newline at end of file +} diff --git a/terraform/modules/s3-static-site/main.tf b/terraform/modules/s3-static-site/main.tf index cfcb502..191f05c 100644 --- a/terraform/modules/s3-static-site/main.tf +++ b/terraform/modules/s3-static-site/main.tf @@ -1,6 +1,8 @@ resource "aws_s3_bucket" "site_bucket" { bucket = var.bucket_name + force_destroy = true + tags = { Name = var.bucket_name Environment = var.environment